Schneier on Security

Clive Robinson • November 18, 2011 10:19 AM

@ Robert T,

“I can personally attest to having seen Power analysis methods used in 1980,”

Likewise I can show that in the 1980’s I developed similar power analysis methods, and more importantly went on to develop RF injection attacks that worked better than DPA.

I then went on to develop active fault injection attacks using modulated RF.

The problem back in the 80’s for non accademic researchers was the “killing the Golden Goose” issue. Often the company you worked for would do almost anything (including sacking) people to keep security faults secret. The story behind the development of “smart cards” and later “SIMs” would make many peoples eyes open very wide.

I emailed Paul when I first saw the DPA paper and told him he could do better with RF, however his reply was notable for all the wrong reasons.

And it still goes on today we see the likes of “custom solutions” such as MiFare etc getting broken into followed by the usual round of denials, legal action, and other less savoury forms of intimidation.

I had the same “don’t kill the goose” issue with showing fingerprint readers were very susceptable to simple fakes using the red wax from Edam cheese and copydex rubber solution glue long long before “gummy fingers” (and I got the idea for faking fingerprints when eight from a Sherlock Holmes story). Likewise when I came up with a way to frig DNA forensic test results I was told “it can’t possibly work” but that all changed when an australian researcher did pretty much the same thing and actuall did the work instead of neigh saying as many others in the field had.

And several other things all of which “nobody want’d to know about” for mainly commercial but sometimes status reasons. Call it “rocking the boat”, “killing the goose that lays golden eggs” etc it’s the same old story “change the percieved wisdom and thus the status quo and fear says “our free lunch will get snatched away”.

Am I upset because I’ve lost fame and glory, no, I’m upset because people even people who should know a lot better want to push “snake oil” to their benifit and others loss.